search cancel

Disarm appears to change file names or file types of attachments


Article ID: 224307


Updated On:


Messaging Gateway


End users report the file names or content types have been changed by the Messaging Gateway (SMG) Disarm feature such that they have different file names or appear as different file types after Disarm reconstruction.


The SMG Disarm feature does not change the file type of the attachment but if a message has attachments with different content types than is reported in the attachment metadata, then Disarm will update the attachment metadata to match the attachment's true file type. This does not affect the attachment name but may affect how the end user mail client displays the attachment or its file name.

This may be the result of the sending mail client naively setting the Content-Type metadata based on file extension rather than file content.

Example: A message with an attachment reported as attachment/pkcs7-mime in the attachment metadata but which actually includes attachment/pdf content will have the Content-Type metadata in the message modified to show attachment/pdf rather than the original attachment/pkcs7-mime.

Original Message

Content-Type: application/pkcs7-mime;
Content-Disposition: attachment;
Content-Transfer-Encoding: base64

After Disarm

Content-Type: application/pdf;
Content-Disposition: attachment;
Content-Transfer-Encoding: base64


Release : 10.7.4

Component : Disarm


This behavior is under investigation by SMG product engineering to confirm that this is expected and desired behavior for the Disarm feature. 

It is unlikely that this behavior will be changed as SMG Disarm is correcting what may, in some cases, be a malicious attempt to bypass attachment scanning.